Role Binding¶

This chapter will detail how to:

• Grant/modify permissions (Roles) on given Resources to a User (Idp or Robot User).
• Remove all permissions on a Ressource from a User (Idp or Robot User).

Set Roles to Users¶

• A clusterAdmin can grant admin privileges on a cluster or any lower level ressources to other users.

• A repoOwner of a given repository (or a clusterAdmin as mentioned above) can set any level of access to "their" repo to users by running the command:

  pachctl auth set <ressource> <ressource name> [role1,role2 | none ] <prefix:subject>
  

To keep using our Auth0 example and illustrate the attribution of a given Role to a User, let's have our Root User (with default clusterAdmin privileges) give repoReader access to a repo to our one-pachyderm-user@gmail.com user.

In particular, we will:

1. Connect as our Root User again.
2. Create a repo named testinput containing one text file.
3. Grant repoReader access on this repo to our user one-pachyderm-user@gmail.com registered with our IdP (Auth0).
4. See what happens when one-pachyderm-user@gmail.com tries to write in the repo without the proper writing access.

• First, let's connect as our Root User:

  pachctl auth use-auth-token
  

  You will be asked to re-enter your Root token.

• Second, create a Repo as follow:

  mkdir -p ./testinput 
  printf "this is a test" >./testinput/test.txt
  pachctl create repo testinput
  cd testinput && pachctl put file testinput@master -f test.txt
  

  A quick pachctl list repo will list your new repo and display your access level on that repo as a clusterAdmin.

• Third, grant repoReader access to our user one-pachyderm-user@gmail.com:

  pachctl auth set repo testinput repoReader user:one-pachyderm-user@gmail.com
  

  ... and take a quick look at his access level:

  pachctl auth get repo testinput
  

  The command returns the list of users granted access to this repo and their associated access level.

  user:one-pachyderm-user@gmail.com: [repoReader]
  pach:root: [repoOwner]
  

  Note

  Note that the user one-pachyderm-user@gmail.com has a prefix user. Pachyderm defines 4 prefixes depending on the type of user:

  • robot
  • user
  • group
  • pipeline (as mentioned above, this prefix will not be used in the context of granting privileges to users. However, it does exist. We are listing it here to give an exhauxtive list of all prefixes.)

  Aditionnally, the "everyone" user allClusterUsers has no specific prefix. See the example below to learn how to assign repoReader access to allClusterUsers on a repo.

• Finally, have one-pachyderm-user@gmail.com try to add a file to testinput without proper writing privileges:

  # Login as `one-pachyderm-user@gmail.com`
  pachctl auth login
  # Try to write into testinput repo
  printf "this is another test" >./testinput/anothertest.txt
  cd testinput && pachctl put file testinput@master -f anothertest.txt
  

  The command returns an error message:

  user:one-pachyderm-user@pachyderm.io is not authorized to perform this operation - needs permissions [REPO_WRITE] on REPO testinput
  

Set Roles to Groups¶

If your IdP enables group support, you can grant access on Pachyderm ressources to a group of users.

Let's keep using our Auth0 example as an illustration, and:

1. As a clusterAdmin, create a Group in Auth0.
2. Assign our user to the newly created group.
3. Update our connector accordingly.
4. Grant the group an owner access to a specific repo in Pachyderm.

• 1- Group creation

  An Authorization link should now show on your Auth0 webpage. In Authorization/Groups, create a group. Here testgroup:

• 2- Add your user to your group

  In Authorization/Users, select your user one-pachyderm-user@gmail.com and add them to your testgroup as follow.

  In User Mangement/Users, you user should now show the following addition to their app_metadata:

  {
      "authorization": {
          "groups": [
          "testgroup"
          ]
      }
  }
  

  - 3- Update your connector
  oidc-dex-connector.json

  {
      "type": "oidc",
      "id": "auth0",
      "name": "Auth0",
      "version": 1,
      "config":{
      "issuer": "https://dev-k34x5yjn.us.auth0.com/",
      "clientID": "hegmOc5rTotLPu5ByRDXOvBAzgs3wuw5",
      "clientSecret": "7xk8O71Uhp5T-bJp_aP2Squwlh4zZTJs65URPma-2UT7n1iigDaMUD9ArhUR-2aL",
      "redirectURI": "http://<ip>:30658/callback",
      "scopes": ["groups", "email", "profile"],
      "claimMapping":{
          "groups": "http://pachyderm.com/groups"
      },
      "insecureEnableGroups": true
      }
  }
  

  oidc-dex-connector.yaml

  type: oidc
  id: auth0
  name: Auth0
  version: 1
  config:
      issuer: https://dev-k34x5yjn.us.auth0.com/
      clientID: hegmOc5rTotLPu5ByRDXOvBAzgs3wuw5
      clientSecret: 7xk8O71Uhp5T-bJp_aP2Squwlh4zZTJs65URPma-2UT7n1iigDaMUD9ArhUR-2aL
      redirectURI: http://<ip>:30658/callback
      scopes: 
      - groups
      - email
      - profile
      claimMapping:
          groups: http://pachyderm.com/groups
      insecureEnableGroups: true
  

  Note the addition of the scopes and claimMapping fields to your original connector configuration file. Update your connector:

  pachctl idp update-connector auth0 --version 2
  

  Your group is all set to receive permissions to Pachyderm's ressources.

• 4- Grant the group an admin access to a specific repo in Pachyderm.

  pachctl auth set repo testinput repoOwner group:testgroup
  

  A quick check at this repo should give you its updated list of users an their access level:

  pachctl auth get repo testinput
  

  System Response

  pach:root: [repoOwner]
  user:another-pachyderm-user@gmail.com: [repoReader]
  group:testgroup: [repoOwner]
  

  Useful note

  The following command pachctl auth get-groups lists the groups that have been defined on your cluster.

Example¶

In this diagram, the data-scientists group has been assigned the repoReader role on the cluster. This gives them permissions to read all repos in all projects.

The IdP user one-pachyderm-user@company.io has been assigned the repoOwner role on the nlp project. This gives them permission to read, write and grant permissions for repos within the nlp project. It does not give them any permission on the image-recognition project, or on the cluster itself.

If one-pachyderm-user@company.io was a member of the data-scientists group, then they would cumulate both roles: repoReader on all repo and repoOwner on the nlp project.

The IdP user another-pachyderm-user@company.io has been assigned the repoWriter role on the repo categorize-text. This gives them permission to read and write in that repo, but not to access any other repo, project, or the cluster itself.